Red Hat Product Errata RHSA-2025:3454 - Security Advisory
Issued:
2025-04-02
Updated:
2025-04-02

RHSA-2025:3454 - Security Advisory

Synopsis

Moderate: Red Hat JBoss Web Server 5.8.3 release and security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Web Server 5.8 on Red Hat Enterprise Linux versions 7, 8, and 9.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 5.8.3 serves as a replacement for Red Hat JBoss Web Server 5.8.2. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.

Security Fix(es):

  • tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT [jws-5] (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 5 for RHEL 9 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 8 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 7 x86_64

Fixes

  • BZ - 2351129 - CVE-2025-24813 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

JBoss Enterprise Web Server 5 for RHEL 9

SRPM
jws5-tomcat-9.0.87-8.redhat_00008.1.el9jws.src.rpm SHA-256: 3c38ed185520c248fd9b042998ed21e01f0a4dff468ee05abccb59a983e4d4c8
x86_64
jws5-tomcat-9.0.87-8.redhat_00008.1.el9jws.noarch.rpm SHA-256: 154aa629a0ff8f16fcd12db277481ba262a20a211b2d8ebf660a3b26c8987b2d
jws5-tomcat-admin-webapps-9.0.87-8.redhat_00008.1.el9jws.noarch.rpm SHA-256: d89a829b1aad18220a26014e2be50cba8a82c78eb5b2a0280161c0117345d478
jws5-tomcat-docs-webapp-9.0.87-8.redhat_00008.1.el9jws.noarch.rpm SHA-256: 136b640005dae4c941e177e0c4482e245faedc28d4a961434cca5da8d11506ed
jws5-tomcat-el-3.0-api-9.0.87-8.redhat_00008.1.el9jws.noarch.rpm SHA-256: 17a5dc655b3bda9833dff9f07c6fb426a1876f333c0ee4454631e21680ec559a
jws5-tomcat-javadoc-9.0.87-8.redhat_00008.1.el9jws.noarch.rpm SHA-256: 7577867e242abc3efd69a8c0658312b91a8bfb7d31fd1a2c4b30be2cba808da8
jws5-tomcat-jsp-2.3-api-9.0.87-8.redhat_00008.1.el9jws.noarch.rpm SHA-256: 119039566d9e1b0a5f1d59e909cfd244ee5f7cc1be7ea10838592325698fadff
jws5-tomcat-lib-9.0.87-8.redhat_00008.1.el9jws.noarch.rpm SHA-256: a0b75668740fb7eaa871848521ac64f100fc73d9d1c206a2f2ae89dede7d14c2
jws5-tomcat-selinux-9.0.87-8.redhat_00008.1.el9jws.noarch.rpm SHA-256: 5d5bf33488717f72904f7b9b71ea6922198bc9207ed1e61ee167e91169b8a274
jws5-tomcat-servlet-4.0-api-9.0.87-8.redhat_00008.1.el9jws.noarch.rpm SHA-256: 0c2c44009d7549954f2f9f3f229ce46a3683deb666ed6bba8620f217df0f57b7
jws5-tomcat-webapps-9.0.87-8.redhat_00008.1.el9jws.noarch.rpm SHA-256: 2554d7279374e4fde6e9aed59cebc058a5fedc40c95c1316da12864e0dd60449

JBoss Enterprise Web Server 5 for RHEL 8

SRPM
jws5-tomcat-9.0.87-8.redhat_00008.1.el8jws.src.rpm SHA-256: 4573260e3efef3e6f8223c2e6232a03dbea6906e73311c827e50320519e6e00b
x86_64
jws5-tomcat-9.0.87-8.redhat_00008.1.el8jws.noarch.rpm SHA-256: d9ad261a3887537b2b4c5b5f8c1ec32e0af957d47165d4f77e429b69d69aec55
jws5-tomcat-admin-webapps-9.0.87-8.redhat_00008.1.el8jws.noarch.rpm SHA-256: 553004aed2b658939d61f17d24ec89658de05e5890b9c28155b2fa80436f8999
jws5-tomcat-docs-webapp-9.0.87-8.redhat_00008.1.el8jws.noarch.rpm SHA-256: 94e83d49d8fe9237ff7db94b7bf18579c40d52c1ff089d2bdc66a7cb88d0f877
jws5-tomcat-el-3.0-api-9.0.87-8.redhat_00008.1.el8jws.noarch.rpm SHA-256: 95c43011826eaa1e7e8b03a5c2b0254f8521ec82747689c2ee89253e518cb2d5
jws5-tomcat-javadoc-9.0.87-8.redhat_00008.1.el8jws.noarch.rpm SHA-256: d91f99084055bd1a98e2ed86d7162cceb4a516f1a36f52de146323a4d91d2b95
jws5-tomcat-jsp-2.3-api-9.0.87-8.redhat_00008.1.el8jws.noarch.rpm SHA-256: e4ce3d07b4351b57bf052be91ecc2fdf6b8f3125d127c8b808be55a7ac6fad30
jws5-tomcat-lib-9.0.87-8.redhat_00008.1.el8jws.noarch.rpm SHA-256: 9080b6c3b1317da7947ea35bf4a11da5de76c585267abac978b2aabdf569305f
jws5-tomcat-selinux-9.0.87-8.redhat_00008.1.el8jws.noarch.rpm SHA-256: bb04e767a9cc97496db2d4e4c92bc197800a8d0e99164225e93acaa0628b926a
jws5-tomcat-servlet-4.0-api-9.0.87-8.redhat_00008.1.el8jws.noarch.rpm SHA-256: 8aa69d2eed45ab204cfc66634065c1e64c7bf6e156066ad02926d9c2693739dc
jws5-tomcat-webapps-9.0.87-8.redhat_00008.1.el8jws.noarch.rpm SHA-256: 88a39ddf5ebdd6693778177fd156d436f8aee1f4169cb1c5b5fa01f9a12c5b57

JBoss Enterprise Web Server 5 for RHEL 7

SRPM
jws5-tomcat-9.0.87-8.redhat_00008.1.el7jws.src.rpm SHA-256: e8487a8cf93bdef3e3403e09bfbab31d1594bf42a34add9fd30b9030541699aa
x86_64
jws5-tomcat-9.0.87-8.redhat_00008.1.el7jws.noarch.rpm SHA-256: 303b85aa5fe30a68739ccf2e596f49355a1c2c64f370d99b5864bcfa1abdb40d
jws5-tomcat-admin-webapps-9.0.87-8.redhat_00008.1.el7jws.noarch.rpm SHA-256: 1b932140cf3c6eab5bab4acb2a07d036dabb57dab38da59c35655fba1ab4bc70
jws5-tomcat-docs-webapp-9.0.87-8.redhat_00008.1.el7jws.noarch.rpm SHA-256: 92ac24c91b9e5d550f908ce15207c4c5a246e42b8bff3597cf8570836247740a
jws5-tomcat-el-3.0-api-9.0.87-8.redhat_00008.1.el7jws.noarch.rpm SHA-256: b4337a6fcb49e28ea0187f9e78c292f18794648ef903cce58afa7e0586016c64
jws5-tomcat-java-jdk11-9.0.87-8.redhat_00008.1.el7jws.noarch.rpm SHA-256: 9a78c92ca6bc9653359cb3647e709423f60f79cc4aab64796f822264d0ee538b
jws5-tomcat-java-jdk8-9.0.87-8.redhat_00008.1.el7jws.noarch.rpm SHA-256: 17a9cba469fbe57530f719cedf6615d2ec71bf0fce21a8c522aba83e9720ecc2
jws5-tomcat-javadoc-9.0.87-8.redhat_00008.1.el7jws.noarch.rpm SHA-256: e9e41cf11c8c79c4cd5f845994462f31c11816d2fb4fcaa41a2aee9d2df007eb
jws5-tomcat-jsp-2.3-api-9.0.87-8.redhat_00008.1.el7jws.noarch.rpm SHA-256: 39a4dbca5f843320b15750e278eb91516392e959a36412d7077cca8e49614a70
jws5-tomcat-lib-9.0.87-8.redhat_00008.1.el7jws.noarch.rpm SHA-256: ae5877b2d2ebd466af262573796fab6c3a30bf11fad7b5550a60370a01e009df
jws5-tomcat-selinux-9.0.87-8.redhat_00008.1.el7jws.noarch.rpm SHA-256: 13bf5f6ddb164c59fce7b3f2f6dfac62a7091016c22370ae19677c48c4713e93
jws5-tomcat-servlet-4.0-api-9.0.87-8.redhat_00008.1.el7jws.noarch.rpm SHA-256: 2a46c2a526a89d8f67dcc351543d4ef88238d0db07260205766cb69a6ae48692
jws5-tomcat-webapps-9.0.87-8.redhat_00008.1.el7jws.noarch.rpm SHA-256: 83abe98ecd9af1b718432ae9bdb131633e09aedf950d418b249c464e801c689b

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.